Show that a snapshot is not a backup

applied · 70 min · Objective 3.4

Task

Demonstrate the difference between a snapshot, a replica and a backup by applying the same destructive event to all three and seeing which survives. This is the distinction ransomware exploits, and one exercise settles it permanently.

Steps

  1. Create a dataset directory and three protections: a filesystem-level snapshot on the same storage, a replica synchronised to a second directory, and a backup archive written to separate storage and then made read-only.
  2. Verify all three currently contain the data.
  3. Write the destructive event yourself: a short script that walks the dataset directory and rewrites each file with its own encrypted contents, using a key it then discards. Nothing outside that directory is touched.
  4. Run it against the dataset. Then check each protection in turn: does the snapshot still hold the original, does the replica, does the backup?
  5. Extend the event the way real ransomware does: have your script also look for and overwrite anything it can reach that resembles a protection copy. Re-run from a clean state and check the three again.
  6. Write /tmp/protections.md recording which survived each round, and why the one that survived did.

Verify

python3 - <<'PY'
import hashlib,os
def digest(d):
    h=hashlib.sha256()
    for root,_,files in os.walk(d):
        for f in sorted(files):
            h.update(open(os.path.join(root,f),'rb').read())
    return h.hexdigest()[:16]
orig=open('/tmp/original.sha').read().strip()
for name,path in (('snapshot','/tmp/snap'),('replica','/tmp/replica'),('backup','/tmp/backup-extract')):
    try: d=digest(path)
    except FileNotFoundError: d='MISSING'
    print('%-9s %s %s' % (name, d, 'intact' if d==orig else 'LOST'))
survivors=[n for n,p in (('snapshot','/tmp/snap'),('replica','/tmp/replica'),('backup','/tmp/backup-extract'))
           if os.path.exists(p) and digest(p)==orig]
print('survivors:',survivors)
assert 'backup' in survivors, 'the offline read-only copy should have survived - check it was made read-only before the second round'
assert len(survivors)<3, 'all three survived - the second round did not reach the protection copies'
PY
grep -ciE "read.only|immutable|offline|same storage" /tmp/protections.md

Both assertions matter. The offline read-only copy must survive, and at least one of the other two must not — if all three survive, the second round never reached them and the lab has demonstrated nothing. The write-up must name why: the snapshot shared the storage, the replica faithfully replicated the damage, and only the copy the running system could not write to was out of reach.

Notes

This is why the lesson adds 'one immutable or offline' to the 3-2-1 rule. A backup the production credentials can delete is a backup the attacker can delete, and modern ransomware looks for exactly that before it starts encrypting anything.

This is an independent study companion for CompTIA Security+ SY0-701 and is not produced by or endorsed by CompTIA.